Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

€54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

discuss.ai.google.dev

Post reply on HN
Print view View original

141–150 of 325 posts

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#141

Post by lxgr »

draygonia wrote: post #130
CWwdcdk7h wrote: post #93

Earlier quoted context omitted.

Google doesn't allow disconnecting credit card from account unless you close it. That includes situation when you are just trying out free tier.

Does Google allow a privacy card that you can control whether an account is connected to it or not? That wouldn't help if someone racked up a ton of charges and Google bills daily, though.

A failure to pay does not extinguish the underlying debt owed. While the US seems pretty dysfunctional (or customer friendly, depending on how you see it) when it comes to collecting on debts, this is not the case globally.

And even in the US, you could presumably easily find all your Google accounts (including personal ones) locked until you pay the outstanding sum. Not something I'd risk, personally.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#142

Post by ch0wn »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

This should be illegal. If a contractor your hired to swap out a tile on your bathroom floor billed you for remodelling your back garden, you would obviously have the legal right to refuse that.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#143

Post by [deleted] »

nurettin wrote: post #135
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

I'd buy the technically impossible angle. Even if you manage to get your microservices to synch every penny spent to your payment account at realtime (impossible) you still have to waiver the excess, losing some money every time someone goes past their quota.

[deleted]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#144

Post by Nathanba »

Illniyar wrote: post #75

I think the logistics of calculating cost in real time is something that is extremely hard. I don't think there is one big cloud service provider that has hard limits instead of alerts. As long as they revert the charge when notified of scenarios like this , and they have historically done so for many cases, it's fine. It's an acceptable workaround for a hard problem and the cost of doing business ( just like Credit…

Why would it be hard to calculate cost? Multiply a fixed price * requests/time ? It doesn't have to be exact in real time, it just has to report something approximately useful in realtime.

It's absolutely not fine to be at the mercy of other people, that's what we buy cloud products or really any products for: So that we are not at the mercy of hardware faults, bad weather, bad teeth, hunger, thirst, [insert anything]

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#145

Post by Leomuck »

benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

That's actually crazy. So I can build a project I love, that does good, but somehow get in a situation where I'm accidentally paying 30.000€ (or 50.000€) to a big tech company? How is that fair? I mean yes, as a software engineer, you ought to reflect on all possible weaknesses, but there was a time when overlooking something meant something completely different than being down 30/50k. That is actually life-altering.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#146

Post by lxgr »

pwdisswordfishs wrote: post #128
lxgr wrote: post #113

Earlier quoted context omitted.

API keys for Firebase . While Google really messed up here, I doubt they ever published anything claiming that no Google API keys at all are secrets.

Google Maps is not Firebase. And "Firebase AI Logic" sure sounds like something easy to confuse with a Firebase service...

The same principle applies, though.

I'm absolutely not defending Google here, to be clear: Retroactively expanding the scope of an API "key" explicitly designated as "public/non-sensitive" is very bad.

But the concept itself does make some sense, and I'm just noting that there's precedent both across Google and other companies.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#147

Post by walthamstow »

nurettin wrote: post #135
benterix wrote: post #90

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours > By the time we reacted, costs were already around €28,000 > The final amount settled at €54,000+ due to delayed cost reporting So much for the folks defending these three companies that refused to provide hard spending cap ("but you can set the budget", "you are doing it wrong if you worry about billing", "ha…

I'd buy the technically impossible angle. Even if you manage to get your microservices to synch every penny spent to your payment account at realtime (impossible) you still have to waiver the excess, losing some money every time someone goes past their quota.

I'm with you. And what do you even do when the quota is breached, nuke the resources? People will complain about that just as much as overspends.

I don't buy the 'evil corp screwing people' angle either. They are making farrr too much legit money to care about occasionally screwing people out of 20k and 50k.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#148

Post by miltonlost »

JohnScolaro wrote: post #50

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours. By the time we reacted, costs were already around €28,000. I had a similar experience with GCP where I set a budget of $100 and was only emailed 5 hours after exceeding the budget by which time I was well over it. It's mind boggling that features like this aren't prioritized. Sure it would probably make Google…

> Sure it would probably make Google less money short term, but surely that's more preferable to providing devs with such a poor experience that they'd never recommend your platform to anyone else again.

Welcome to late-stage capitalism, where there is no long-term thinking, only short-term profit stealing, and Fuck You I Got Mine.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#149

Post by drfloyd51 »

whywhywhywhy wrote: post #137
Maxious wrote: post #98

Earlier quoted context omitted.

> The Gemini API supports monthly spend caps at both the billing account tier and project levels. These controls are designed to protect your account from unexpected overages, and the ecosystem to ensure service availability https://ai.google.dev/gemini-api/docs/billing#project-spend-...

Why is the default uncapped then other than the hopes of billing people who screw up or get exploited.

See also: Why is the default cap so low? I lost €78bojillion because my API stopped working.

Re: €54k spike in 13h from unrestricted Firebase browser key accessing Gemini APIs

#150

Post by arcticfox »

JohnScolaro wrote: post #50

> We had a budget alert (€80) and a cost anomaly alert, both of which triggered with a delay of a few hours. By the time we reacted, costs were already around €28,000. I had a similar experience with GCP where I set a budget of $100 and was only emailed 5 hours after exceeding the budget by which time I was well over it. It's mind boggling that features like this aren't prioritized. Sure it would probably make Google…

I get furious every time this comes up and somehow there are bootlickers ready to defend big tech on it.

My ~2 person small business was almost put out of business due to a runaway job. I had instrumented everything perfectly according to the GCP instructions - as soon as billing went over the cap the notification was hooked up to a kill switch, which it did instantly.

GCP sent the notification they offered as best practice 6 HOURS late. They did everything they could to not credit my account until they realized I had the receipts. They said an investigation revealed their pipeline was overwhelmed by the number of line items and that was the reason for the lag. ... The exact scenario it is supposed to function in. JFC.

Post reply on HN